PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46006 Linux CVE debrief

An integer overflow vulnerability exists in the Linux kernel's Nouveau DRM driver, specifically within the `nouveau_gem_pushbuf_reloc_apply()` function. The flaw arises from a 32-bit unsigned integer overflow during bounds checking of GPU pushbuffer relocations. The `reloc_bo_offset` field is defined as `__u32` in the UAPI header, and when added to the integer literal `4`, the operation is performed in 32-bit arithmetic due to C integer promotion rules. This allows the sum to wrap around before being compared against the `size_t` buffer size, potentially bypassing the bounds check and enabling out-of-bounds memory access. The vulnerability affects systems utilizing NVIDIA GPUs with the open-source Nouveau driver. The fix casts the operands to `u64` to ensure 64-bit arithmetic, preventing the overflow. Multiple stable kernel branches have received patches.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-19
Advisory published
2026-05-27
Advisory updated
2026-06-19

Who should care

Organizations running Linux systems with NVIDIA GPUs using the Nouveau open-source driver, particularly multi-user or containerized environments where unprivileged users may access GPU resources. Cloud providers offering GPU instances with Nouveau driver support. Embedded systems and workstations utilizing NVIDIA graphics with kernel-level GPU access.

Technical summary

The vulnerability exists in `drivers/gpu/drm/nouveau/nouveau_gem.c` in the `nouveau_gem_pushbuf_reloc_apply()` function. The bounds check `if (r->reloc_bo_offset + 4 > nvbo->bo.base.size)` performs 32-bit unsigned arithmetic because `reloc_bo_offset` is `__u32` and `4` promotes to `unsigned int`. When `reloc_bo_offset` exceeds `UINT_MAX - 4`, the addition wraps to a small value, causing the comparison to incorrectly pass and allowing relocation operations beyond buffer boundaries. The fix casts to `u64`: `if ((u64)r->reloc_bo_offset + 4 > nvbo->bo.base.size)`. This is a classic integer overflow leading to insufficient bounds validation, exploitable for potential information disclosure or memory corruption in kernel space.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from distribution vendor when available, referencing the specific stable branch commits
  • Verify running kernel version against patched versions in stable branches (commits referenced in source)
  • Monitor NVIDIA GPU systems using Nouveau driver for unusual behavior or stability issues
  • Review system logs for GPU-related errors that may indicate exploitation attempts
  • Consider restricting unprivileged access to DRM/GPU interfaces where feasible via system hardening
  • Subscribe to Linux stable kernel announcements for security update notifications

Evidence notes

Vulnerability description confirms integer overflow in 32-bit arithmetic during relocation bounds checking. Five kernel.org stable branch commits provided as references. CVE published 2026-05-27 with 'Awaiting Analysis' status. No CVSS score or severity assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46006 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46006

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46006 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46006

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2fc87d37be1b730a149b035f9375fdb8cc5333a5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/332884f5eb79dd60a7162b079d09d39208567a31

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d749a9a0ee4014681487e7ae549901aa8c176637

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e441d5c23ec644c8d27593db3b8928e8933512a9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fa297e919d1680c38ab268ff952b1698dac987f6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.